SPRING BOOT 3.x WEBFLUX + OAUTH2/JWT ENDPOINT

SECURITY CONFIG (SecurityConfig.java)
→ @Configuration class with @EnableReactiveMethodSecurity
→ SecurityWebFilterChain bean: permit OPTIONS + /login; require JWT on all others
→ JwtDecoder bean: Decode RS256 tokens from issuer (Auth0, Okta, etc.)
→ ReactiveAuthenticationManager: Extract issuer claim ("iss") + scope validation

JWT VALIDATION FILTER
→ Extract Bearer token from Authorization header
→ Decode + verify signature + check expiration
→ Build SecurityContext with authorities (scopes as roles)
→ Return Mono<Void> or error if invalid

RESTFUL ENDPOINT (ApiController.java)
@PostMapping("/api/data")
public Mono<ResponseEntity<DataResponse>> createData(
  @RequestBody DataRequest req,
  @AuthenticationPrincipal Mono<JwtAuthenticationToken> auth
) {
  return auth
    .switchIfEmpty(Mono.error(new UnauthorizedException()))
    .flatMap(token -> validateScope(token, "write:data"))
    .flatMap(token -> repository.save(req).map(ResponseEntity::ok))
    .onErrorResume(InvalidTokenException.class, e -> Mono.just(ResponseEntity.status(401).build()));
}

TESTING (WebTestClient)
→ Test 1: Missing token → 401 Unauthorized
→ Test 2: Invalid signature → 401 Unauthorized
→ Test 3: Expired token → 401 Unauthorized
→ Test 4: Valid token + correct scope → 200 + response body
→ Test 5: Valid token + insufficient scope → 403 Forbidden

DEPLOYMENT NOTES
→ Token secret/JWK URL set via environment (not hardcoded)
→ CORS headers configured (if frontend is cross-origin)
→ Actuator endpoints secured (only /health + /ready exposed)

COMMON TRAP: Using Mono.fromCallable() on blocking JWT library → kills reactive benefits. Use reactive-native JWT decoder instead.